Certified Blue Team Level 1 (BTL1)
Become a certified Blue Team defender. This hands-on course teaches essential SOC and Incident Response skills, covering forensics, SIEM analysis (Splunk), phishing defense, and MITRE ATT&CK concepts.
Training at a glance
Level
Intermediate
Duration
4 Days
Experience
1-2 year: Security
Average Salary
$130,000
Labs
Yes
Level
Intermediate
Duration
eLearning
Experience
1 year: Penetration Tester
Average Salary
$119,122
Labs
Yes
Training Details
BTL1 is designed to train technical security defenders capable of defending networks and responding to cyber incidents. The comprehensive skills and tools learned are directly applicable to a range of operational security roles (SOC, Incident Response, Forensics) and are actively used by defenders around the world. The course emphasizes practical application across multiple security domains.
Module 1: Security Fundamentals
- Soft Skills for Security Professionals
- Security Controls Overview
- Networking 101 (TCP/IP, Common Protocols)
- Security Management Principles
- Active Directory Fundamentals
Module 2: Phishing Analysis
Types of Phishing Emails (Spear, Whale, Vishing, etc.)
Tactics and Techniques Used by Threat Actors
Investigating a Phishing Email (Headers, URLs, Attachments)
Analyzing Phishing Artifacts
Taking Defensive Actions and Reporting
Phishing Response Challenge
Module 3: Threat Intelligence
Threat Actors and Advanced Persistent Threats (APTs)
Operational Threat Intelligence (TTPs and Incident Validation)
Tactical Threat Intelligence (IOCs and Automated Blocking)
Strategic Threat Intelligence (Risk and Executive Reporting)
Module 4: Digital Forensics
Forensics Fundamentals and Chain of Custody
Digital Evidence Collection Techniques
Windows Investigations (Registry, Event Logs, Pre-fetch)
Linux Investigations (Log Files, Users, Shell History)
Memory Analysis With Volatility
Disk Analysis With Autopsy (File System and Artefact Analysis)
Module 5: Security Information and Event Monitoring (SIEM)
Logging and Log Aggregation Principles
Correlation and Alerting Concepts
Using Splunk SIEM for Investigation and Querying
Module 6: Incident Response
Preparation Phase and Documentation
Detection and Analysis Phase (Triage)
Case Management and Documentation
Containment, Eradication, and Recovery Phase
Lessons Learned and Reporting
Introduction to the MITRE ATT&CK Framework
- IT Personnel
- Security Analysts
- Incident Responders
- Threat Intelligence Analysts
- Forensics Analysts
1–2 years security experience
Upcoming Classes
We Offer More Than Just Hack the Box Training
Our successful training results keep our corporate and military clients returning. That’s because we provide everything you need to succeed. This is true for all of our courses.
Strategic Planning & Project Management
From Lean Six Sigma to Project Management Institute Project Management Professional, Agile and SCRUM, we offer the best-in-class strategic planning and project management training available. Work closely with our seasoned multi-decade project managers.
IT & Cybersecurity
ATA is the leading OffSec and Hack the Box US training provider, and a CompTIA and EC-Council award-winning training partner. We offer the best offensive and defensive cyber training to keep your team ahead of the technology skills curve.
Leadership & Management
Let us teach your team the high-level traits and micro-level tools & strategies of effective 21st-century leadership. Empower your team to play to each others’ strengths, inspire others and build a culture that values communication, authenticity, and community.
